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CLAIMS 

11. A method suitable for use in a communication device for determining the 

2 disposition of incoming e-mail from a sender, said method comprising the steps of: 

3 establishing the identity of the sender to provide a sender identifier; 

4 determining a cumulative penalty count value associated with said sender 

5 identifier; 

6 retrieving a system resource usage status associated with the communication 

7 device; and 

8 processing the incoming e-mail on the basis of said cumulative penalty count 

9 value and said system resource usage status. 

1 2. The method of claim 1 wherein said step of estabUshing the identity of the 

2 sender comprises the step of ascertaining an IP address for the sender. 

1 3. The method of claim 1 wherein said step of estabhshing the identity of the 

2 sender comprises the step of associating the sender with a peer IP address of the 

3 sender TCP connection. 

1 4. The method of claim 1 wherein said step of determining a cumulative penalty 

2 count value comprises the step of assessing a penalty count value to said sender 

3 identifier for an undesirable activity associated with the sender. 

15. The method of claim 4 wherein said cumulative penalty count value comprises 

2 an activity penalty count charged to the sender for current undesirable sender activity 

3 and a time-dependent penalty count determined from previous undesirable sender 

4 activity. 
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16. The method of claim 5 wherein said time-dependent penalty count comprises a 

2 zero value subsequent to a pre-estabUshed retention period. 

1 7. The method of claim 5 wherein said time-dependent penalty count comprises a 

2 prior activity penalty count value reduced by a decay factor. 

1 8. The method of claim 4 wherein said undesirable activity comprises a member 

2 of the group consisting of: sending a large number of e-mails, sending e-mails of 

3 relatively large sizes, using a relatively large amount of TCP connection time, and 

4 causing a TCP timeout. 

1 9. The method of claim 1 wherein said system resource usage status is a function 

2 of a member of the group consisting of: the number of concurrent TCP connections 

3 being maintained, the number of e-mail files in an incoming message queue, and the 

4 amount of disk space being utiUzed for an incoming message queue. 

1 10. The method of claim 1 wherein said step of processing the incoming e-mail 

2 comprises the step of assigning an operating state to the communication device, said 

3 operating state being a function of said system resource usage status. 

1 11. The method of claim 1 0 wherein said operating state is a member of the group 

2 consisting of: a normal operating state, a selective-rejection operating state, and a 

3 random-rej ec tion operating state . 

1 12. The method of claim 11 wherein, for said selective-rejection state, if said 

2 cumulative penalty count value has a zero value, said step of processing the incoming 

3 e-mail comprises the step of accepting the incoming e-mail. 
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1 13. The method of claim 11 wherein, for said selective-rejection state, if said 

2 cumulative penalty count value has a nonzero value, said step of processing the 

3 incoming e-mail comprises the steps of: 

4 specifying a rejection factor; 

5 generating a random number; and 

6 randomly rejecting the incoming e-mail on the basis of said rejection factor and 

7 said random number. 

1 14. The method of claim 1 3 wherein said step of randomly rejecting comprises the 

2 step of accepting the incoming e-mail if said random number is greater than said 

3 rejection factor and rejecting the incoming e-mail if said random number is not 

4 greater than said rejection factor. 

1 15. The method of claim 13 wherein said rejection factor is increased if said 

2 system resource usage status increases and said rejection factor is decreased if said 

3 system resource usage status decreases. 

1 16. The method of claim 11 wherein, for said random-rejection state, if said 

2 cumulative penalty count value has a nonzero value, said step of processing the 

3 incoming e-mail comprises the step of rejecting the incoming e-mail. 

1 17. The method of claim 11 wherein, for said random-rejection state, if said 

2 cumulative penalty count value has a zero value, said step of processing the incoming 

3 e-mail comprises the steps of: 

4 deriving a resource usage factor; 

5 generating a random number; and 

6 randomly rejecting the incoming e-mail on the basis of said resource usage 

7 factor, said random number, and said cumulative penalty count value. 
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1 18, The method of claim 17 wherein said step of randomly rejecting comprises the 

2 step of accepting the incoming e-mail if said random number is greater than a product 

3 of said resource usage factor and said cumulative penalty count value, and rejecting 

4 the incoming e-mail if said random number is not greater than said product of said 

5 resource usage factor and said cumulative penalty count value. 



1 19. The method of claim 1 8 wherein said resource usage factor is increased if said 

2 system resource usage status increases and said resource usage factor is decreased if 

3 said system resource usage status decreases. 



1 



20. A communication device for determining the disposition of incoming e-mail 

y 2 from a sender, said device comprising: 

fIJ 

"J 3 a penalty count filter module having 

y 4 means for identifying the sender; 

W 5 means for assigning a penalty count to the sender, said penalty 

O 6 count being a function of undesirable activity associated 

7 with the sender; 

8 means for determining a resource usage value for said 

9 communication device in receiving e-mail; 

10 means for specifying an operating state for said penalty count 

1 1 filter module, said operating state being a function of said 

12 resource usage value; and 

1 3 an accept/reject filter for disposing of the incoming e-mail on the 

14 basis of said sender penalty count and said operating state. 
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1 21 . The device of claim 20 wherein said means for identifying the sender includes 

2 means for obtaining at least one of a Domain Name Service verification and a peer IP 

3 address of the sender TCP connection. 

1 22. The device of claim 20 wherein said midesirable activity comprises a member 

2 of the group consisting of sending a large number of e-mails, sending e-mails of 

3 relatively large sizes, using a relatively large amount of TCP connection time, and 

4 causing a TCP timeout. 

1 23, The device of claim 20 wherein said system resource usage status is a function 



2 of a member of the group consisting of: the number of concurrent TCP connections 

3 being maintained, the number of e-mail files in an incoming message queue, and the 

4 amount of disk space being utilized for an incoming message queue. 



1 24. A communication device for determining the disposition of incoming e-mail 

2 from a sender, said device comprising: 

3 a sender penalty count data structure for storing a current penalty count value 

4 associated with the sender; 

5 a system resource usage status file for storing a current usage status value for 

6 device e-mail processing resources; and 

7 an accept/reject filter for disposing of the incoming e-mail on the basis of said 

8 penalty count value and said usage status. 

1 25. The device of claim 24 wherein said sender penalty count data structure 

2 includes an entry comprising a member of the group consisting of: a sender 

3 identification value, a cumulative penalty count value, a cumulative e-mail count, a 

4 total e-mail size, a total TCP connection time, and a timestamp value. 
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1 26. A method suitable for use in a communication device for determining the 

2 disposition of incoming e-mail from a sender, said method comprising the steps of: 

3 identifying the e-mail sender by determining a sender IP address; 

4 obtaining a previous sender penalty count value calculated for said sender IP 

5 address; and 

6 accepting or rejecting the incoming e-mail based on said sender penalty count 

7 value. 

1 27. The method of claim 26 further comprising the steps of: 

2 maintaining a behavior trace table entry for the e-mail sender; and 

3 determining said previous sender penalty count from said behavior trace table. 

1 28. The method of claim 27 further comprising the step of updating sender 

2 behavior values in said trace table entry in response to receipt of a sender e-mail. 

1 29. The method of claim 28 wherein said sender behavior values include a 

2 member of the group consisting of: the number of e-mails, the total size of e-mails, 

3 and the total time of TCP connection time. 

1 30. The method of claim 28 wherein said step of updating sender behavior values 

2 comprises the steps of: 

3 reducing said behavior trace table value by a decay factor; and 

4 adding a current behavior trace table value to said corresponding reduced 

5 behavior trace table value. 
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1 31. The method of claim 30 wherein said decay factor is a function of the time 

2 interval between the last two updates of said behavior trace table entry and a pre- 

3 established retention period. 

1 32. The method of claim 26 wherein said sender penalty count value is determined 

2 from undesirable sender activity occurring over a pre-established retention period. 

1 33, The method of claim 32 wherein said undesirable activity comprises a member 



2 of the group consisting of: sending a large number of e-mails, sending e-mails of 

3 relatively large sizes, using a relatively large amount of TCP connection time, and 

4 causing a TCP timeout. 



1 34. The method of claim 26 further comprising the step of updating said sender 

2 penalty count value. 

1 35. The method of claim 34 wherein said step of updating said sender penalty 

2 count value comprises the steps of: 

3 reducing said previous sender penalty count value by a decay factor to yield a 

4 reduced sender penalty count value, said decay factor being a function of 

5 said pre-established retention period; and 

6 adding an activity penalty count value to said reduced sender penalty count 

7 value to yield an updated sender penalty count value, said activity penalty 

8 count value calculated as a function of current sender e-mail activities. 

1 36. The method of claim 35 wherein said decay factor is further a function of the 

2 time interval between calculation of said previous sender penalty count value and 

3 calculation of said activity penalty count value. 
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